flux fleet digest — 2026-09-18 08:09 UTC

Fleet overview (last 24h vs 7-day baseline)

sensor events uniq IPs 7d avg events 7d avg uniq events delta
ai-devbox-1 4207 142 3623 79 +16%
canary-farm-1 5437 165 4117 99 +32%
control-1 3082 124 3572 42 -14%
frantech-ts 76 35 6186 34 -99%
netcup-ts 794 111 894 28 -11%
ru-edge-1 2365 114 2318 30 +2%
sponge-01-ts 1597 134 1018 32 +57%

Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, netcup-ts, ru-edge-1, sponge-01-ts.

Result-tag spikes (campaign candidates)

sensor result 24h 7d avg ratio
canary-farm-1 app-config-python 40 12.5 3.2x
canary-farm-1 env-production 402 118.4 3.4x
canary-farm-1 rails-database-yml 22 7.2 3.0x
canary-farm-1 tarpit-disconnect 105 33.3 3.2x
canary-farm-1 tarpit-module 2565 807.4 3.2x
canary-farm-1 wp-config 40 11.8 3.4x
sponge-01-ts phpmyadmin-login 22 6.0 3.7x
sponge-01-ts tarpit-disconnect 38 11.3 3.4x

Campaign clusters (24h, journey-fingerprinted)

signature IPs events sensors first seen sample journey (6 steps)
3e1c5eb879e7 ⟳ 82 576 ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 08-29 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
4b4cc0ece037 ⟳ 13 91 control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 08-30 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit]
7e61a9500d8b ⟳ 10 490 canary-farm-1,control-1,netcup-ts,ru-edge-1 ⚠FLEET-WIDE 08-29 /bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te
321f17b2aca0 ⟳ 8 64 ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE 08-31 / [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing]
1cf777711bea ⟳ 6 54 ai-devbox-1,canary-farm-1,control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE 09-03 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → /favicon.ico [tarpit-module]
7ea1125e0232 ⟳ 6 85 ai-devbox-1,canary-farm-1,sponge-01-ts ⚠FLEET-WIDE 08-30 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect]
218630667b2c ⟳ 5 210 ai-devbox-1,canary-farm-1,control-1,sponge-01-ts ⚠FLEET-WIDE 09-02 / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → …
850993125b15 ⟳ 4 164 canary-farm-1 08-29 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → …

Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.

First-seen in this window

New paths:

sensor path first seen
canary-farm-1 /seeds/aws_credentials.env.local 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /etc/client_secrets.json.rc1 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /.git/.env.debug.backup 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /azure/.git/config4 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /api/v1/namespaces/default/secrets 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /.config/aws_credentials 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /secrets.txt2024 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /jenkins/config.yml_production 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /scala/.env.old_production 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /srv/.env.production.temp 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /gcp/secrets.txt-old 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /panel/secrets.json3 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /rpc/secrets.txt-old 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /client_secret.json.archived 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /php/.env.production.backup 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /src/main/resources/application.properties 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /.credentials/mail.env 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /.oci/oci_api_key.pem 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /packages/app/.env 2026-09-18 04:09:25.664450-04:00
canary-farm-1 /packages/client/.env 2026-09-18 04:09:25.664450-04:00

New user agents:

sensor user agent first seen
netcup-ts Mozilla/5.0 (Linux; Android 9; Pixel) AppleWebKit/537.36 (KH 2026-09-18 04:09:39.634492-04:00
ai-devbox-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ 2026-09-18 04:09:39.634492-04:00
control-1 Mozilla/5.0 (Linux; Android 7.0; LGMS550 Build/NRD90U) Apple 2026-09-18 04:09:39.634492-04:00
control-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Geck 2026-09-18 04:09:39.634492-04:00
sponge-01-ts Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Fire 2026-09-18 04:09:39.634492-04:00
ru-edge-1 Mozilla/5.0 (iPhone; CPU iPhone OS 16_3 like Mac OS X) Apple 2026-09-18 04:09:39.634492-04:00
ru-edge-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/ 2026-09-18 04:09:39.634492-04:00
frantech-ts Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l 2026-09-18 04:09:39.634492-04:00
control-1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/ 2026-09-18 04:09:39.634492-04:00
sponge-01-ts Mozilla/5.0 (Linux; Android 9; G8141) AppleWebKit/537.36 (KH 2026-09-18 04:09:39.634492-04:00

Top talkers (24h)

sensor IP events trap fams paths first last blocklist ASN org cc POSTed
canary-farm-1 2a01:e0a:3be:cec0:f54c:335a:8d29:be 1857 33 632 09-17 16:58 09-17 17:05 - Free SAS FR 0
ru-edge-1 204.76.203.18 1815 2 568 09-17 04:09 09-18 07:39 ipsum:2 Pfcloud UG (haftungsbeschran NL 0
control-1 204.76.203.18 1799 2 574 09-17 04:09 09-18 07:40 ipsum:2 Pfcloud UG (haftungsbeschran NL 0
canary-farm-1 176.65.144.71 1500 98 743 09-18 06:02 09-18 06:02 - Dedik Services Limited CH 0
ai-devbox-1 94.154.46.244 1285 98 743 09-17 09:24 09-17 09:24 - Omegatech LTD US 0
ai-devbox-1 94.154.46.242 900 95 450 09-17 08:56 09-17 08:56 - Omegatech LTD US 0
ai-devbox-1 195.178.110.159 384 2 372 09-18 05:39 09-18 05:39 ipsum:1 Techoff Srv Limited BG 0
canary-farm-1 213.177.179.52 282 6 11 09-17 20:57 09-17 20:57 - Feo Prest SRL TW 2
control-1 213.177.179.52 282 6 11 09-17 21:15 09-17 21:16 - Feo Prest SRL TW 2
canary-farm-1 192.253.248.94 282 6 11 09-17 20:29 09-17 20:29 ipsum:2 firehol2 Limited Network LTD NL 2
ai-devbox-1 213.177.179.52 282 6 11 09-17 20:55 09-17 20:55 - Feo Prest SRL TW 2
sponge-01-ts 213.177.179.52 282 6 11 09-17 21:15 09-17 21:15 - Feo Prest SRL TW 2
control-1 192.253.248.94 282 6 11 09-17 20:32 09-17 20:33 ipsum:2 firehol2 Limited Network LTD NL 2
netcup-ts 213.209.159.154 247 7 245 09-17 08:25 09-17 08:25 - Feo Prest SRL DE 0
ai-devbox-1 196.89.218.205 152 15 38 09-18 00:54 09-18 00:59 - Office National des Postes e MA 18

Canary economics (24h)

sensor mints distinct minting IPs
ru-edge-1 5 3
control-1 5 3
ai-devbox-1 24 11
canary-farm-1 36 13

Mint failures (24h): none

Mints by type label:

sensor types mints
control-1 ["aws"] 5
ai-devbox-1 ["aws"] 24
canary-farm-1 ["aws"] 36
ru-edge-1 ["aws"] 5

XFF forgery signals (24h)

  • requests with any X-Forwarded-For: 2868
  • multi-entry XFF (forged chains — no proxy appends on the direct path): 0
  • XFF present but ignored as the source (all entries internal, or it agrees with the peer): 0
  • XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 2

TLS split + Host census (24h)

sensor protocol events
ai-devbox-1 http 3535
ai-devbox-1 https 672
canary-farm-1 http 3243
canary-farm-1 https 2194
control-1 http 3082
frantech-ts http 76
netcup-ts http 794
ru-edge-1 http 2365
sponge-01-ts http 1597

Top Host headers:

sensor host events
ai-devbox-1 217.15.163.226 3223
control-1 38.54.2.209 3062
canary-farm-1 109.123.246.142 2918
canary-farm-1 sso.rightabouteverything.show 2508
ru-edge-1 130.94.89.46 2356
sponge-01-ts 89.167.72.144 1519
ai-devbox-1 inference.fapthropic.com 956
netcup-ts 159.195.21.150 702
frantech-ts 209.141.62.110 69
sponge-01-ts poland.payu.com 10

Control node discovery velocity

  • first event ever: 2026-09-12 07:59 UTC (5 days live)
  • daily unique-IP ramp (newest first):
day events uniq IPs
2026-09-18 3082 124
2026-09-17 5129 94
2026-09-16 4795 62
2026-09-15 5378 1
2026-09-14 3152 1
2026-09-13 4254 53
2026-09-12 1813 51
2026-09-11 481 35
2026-09-10 5026 95
2026-09-09 3265 68
2026-09-08 3376 120
2026-09-07 3256 108
2026-09-06 2523 99
2026-09-05 3958 98

Kill-chain watchlist (24h)

sensor IP trap fams journey (chronological) ASN org cc
canary-farm-1 176.65.144.71 98 /config.php [app-config-php] → /settings.php [app-config-php] → /config.js [webapp-config-bundle-js] → /.git/HEAD [fake-git] → /wp-config.php.old [wp-config] → /config.json [config-json] → /wp-config.php~ [wp-config] → /configuration.php [app-config-php] → /local_settings.py [app-config-python] → /.ssh/authorized_keys [authorized-keys-error] → /docker-compose.yaml [docker-compose] → /docker-compose.override.yml [docker-compose] Dedik Services Limited CH
ai-devbox-1 94.154.46.244 98 /.git/HEAD [fake-git] → /.git/config [fake-git] → /wp-config.bak [wp-config] → /config/database.php [app-config-php-database] → /config/app.php [app-config-php-services] → /Gemfile.lock [not-handled] → /composer.json [not-handled] → /.git/index [fake-git] → /config.py [app-config-python] → /docker-compose.yml [docker-compose] → /config.js [webapp-config-bundle-js] → /.dockerenv [not-handled] Omegatech LTD US
ai-devbox-1 94.154.46.242 95 /settings.php [app-config-php] → /configuration.php [app-config-php] → /.git/HEAD [fake-git] → /wp-config.bak [wp-config] → /.aws/credentials [aws-credentials-file] → /.git/config [fake-git] → /wp-config.php.old [wp-config] → /.git/index [fake-git] → /config/database.php [app-config-php-database] → /wp-config.php~ [wp-config] → /wp-config.old [wp-config] → /composer.lock [not-handled] Omegatech LTD US
canary-farm-1 2a01:e0a:3be:cec0:f54c:335a:8d29:be 33 /aws/secrets.env [env-production] → /azure/secrets.env [env-production] → /.github/actions/secrets.env [not-handled] → /.config/aws_credentials.env.disabled [not-handled] → /secrets.env.production [not-handled] → /azure_credentials.env.rc1 [not-handled] → /database/azure_credentials.env_staging [phpmyadmin-login] → /aws_credentials.env.temp [not-handled] → /aws_credentials.env.orig [not-handled] → /docker/azure_credentials.env.sample [not-handled] → /aws_credentials.env.src [not-handled] → /deployment/client_secrets.json.dev [not-handled] Free SAS FR
canary-farm-1 178.16.54.184 32 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /products [not-handled] → /about [not-handled] → /login [webapp-form-login] → /register [webapp-form-signup] → /swagger.json [openapi-spec-json-issued] → /blog [not-handled] → /contact [webapp-form-contact] → /signup [webapp-form-signup] → /docs [openapi-swagger-ui-html] Omegatech LTD NL
ai-devbox-1 178.16.54.184 32 / [tarpit-module] → / [tarpit-disconnect] → / [tarpit] → /about [not-handled] → /swagger.json [openapi-spec-json-issued] → /contact [webapp-form-contact] → /products [not-handled] → /blog [not-handled] → /docs [openapi-swagger-ui-html] → /login [webapp-form-login] → /register [webapp-form-signup] → /signup [webapp-form-signup] Omegatech LTD NL
canary-farm-1 167.99.181.249 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
ai-devbox-1 147.182.149.75 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
canary-farm-1 139.59.132.8 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 159.89.127.165 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
ai-devbox-1 142.93.143.8 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC NL
canary-farm-1 143.110.213.72 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC CA
canary-farm-1 142.93.129.190 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC NL
ai-devbox-1 164.90.228.79 27 / [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] DigitalOcean, LLC DE
ai-devbox-1 196.89.218.205 15 / [tarpit-module] → /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php [phpunit-eval-stdin] → /.git/config [fake-git] → /.git/index [fake-git] → /.DS_Store [ds-store] → / [tarpit-disconnect] → / [tarpit] → /whm [whm-login] → /openid_connect/cpanelid [whm-login] → /login/ [webapp-form-login] → /wp-json/batch/v1 [wp-batch-rejected] → / [wp-batch-rejected] Office National des Postes e MA

SSH/telnet honeypot (single sensor: frantech-ts)

Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.

  • funnel: 13 sources sent credentials → 9 got a shell (69%) → 5 ran a command (56% of shell-getters, 38% of sources)
  • event level: 374 credential attempts → 184 accepted logins → 148 commands (80% of accepted logins go on to run something)
  • telnet (commodity IoT botnets): 26 attempts

New commands this window (0 of 6 distinct):

no command seen for the first time this window

Recurring commands (⟳ seen in an earlier window):

events IPs example source command (head)
55 2 109.160.32.113 "uname -m | awk '{printf $1}'"
55 2 109.160.32.113 "uname -s -v -n -r -m"
16 2 92.118.39.49 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -
16 2 92.118.39.49 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/
3 1 62.171.133.1 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/
3 1 62.171.133.1 "export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -

Credentials: 291 distinct pairs offered this window, 191 new. Concentration is the signal, not the list — top pairs:

attempts user password
2 admin Computer123456
2 admin Company@2023
2 ubuntu yY@1234
2 root server.2016
2 admin Company@2025
2 admin Computer1234
2 root !@123qwaszx
2 root PASS@WORD123